#54949: test: deep-sign the signed-app NODE_OPTIONS specs' app only once
Description of Change
The three NODE_OPTIONS in signed app tests in spec/node.spec.ts each copied the whole unstripped Electron.app and deep-signed it inside the 30s test budget.
- On macOS x64 CI that took 8–27s per test.
- The first test in the describe took longer still. In 5 of 13 sampled
macos-x64 / test (darwin, 1)jobs, its first attempt timed out and it passed only on a Vitest retry, logged as(retry x1)or(retry x2). - The other two tests do the same work and never needed a retry.
This change deep-signs one stripped template in beforeAll, the same approach the Squirrel.Mac updater specs use. Each test clones the template, adds its fixture and re-signs only the outer bundle. On the same runners, the updater spec that clones that template, shallow-signs it and launches the app takes about 1–1.4s.
The apps are still signed with the same identity as before, so the parent-process signature check under test is unchanged. If codesign fails, the test now fails with codesign's output. Before, signing failures were ignored.
I couldn't run this on macOS locally. The template steps are the ones the updater specs already run on macOS CI.
🤖 Generated with Claude Code
Checklist
- I have built and tested this change (the tests are macOS-only; CI runs them)
- I have filled out the PR description
- I have reviewed and verified the changes
- tests are changed or added
Release Notes
Notes: none
Backports
Semver Impact
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron